Add SBOM

.github/workflows/build_and_test_linux.yml

@@ -42,9 +42,19 @@ jobs:
           disk-cache: ${{ github.workflow }}
           repository-cache: true
           cache-save: ${{ github.event_name == 'push' }}
-      - name: Build image
+      - name: Install uv (required for SBOM license scanning)
         run: |
-          bazel build --lockfile_mode=error --config=linux-x86_64 //images/linux_x86_64:image
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+      - name: Build image and product SBOM
+        run: |
+          bazel build --lockfile_mode=error --config=linux-x86_64 \
+            //images/linux_x86_64:image \
+            //:sbom
       - name: Integration tests
         run: |
           bazel test --lockfile_mode=error --config=linux-x86_64 //feature_integration_tests/itf
+      - name: Upload product SBOM to release
+        if: github.event_name == 'release'
+        uses: softprops/action-gh-release@v1
+        with:
+          files: bazel-bin/sbom.spdx.json

.github/workflows/test_and_docs.yml

@@ -73,6 +73,12 @@ jobs:
       - name: Execute Feature Integration Tests
         run: |
           bazel test --config=linux-x86_64 //feature_integration_tests/test_cases:fit
+      - name: Install uv (required for SBOM license scanning)
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+      - name: Build build tools SBOM
+        run: |
+          bazel build --lockfile_mode=error //:build_tools_sbom
       - name: Publish build summary
         if: always()
         run: |
@@ -102,6 +108,11 @@ jobs:
           files: ${{ github.event.repository.name }}_test_reports.zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload build tools SBOM to release
+        if: github.event_name == 'release'
+        uses: softprops/action-gh-release@v1
+        with:
+          files: bazel-bin/build_tools_sbom.spdx.json
       - name: Install Graphviz
         uses: eclipse-score/apt-install@main
         with:

.gitignore

@@ -28,3 +28,6 @@ __pycache__/
 /.gita-workspace.csv
 /build
 artifacts
+
+#Macos
+.DS_Store

BUILD

@@ -12,6 +12,7 @@
 # *******************************************************************************
 
 load("@score_docs_as_code//:docs.bzl", "docs")
+load("@score_sbom//:defs.bzl", "sbom")
 load("@score_tooling//:defs.bzl", "setup_starpls", "use_format_targets")
 
 # Docs-as-code
@@ -45,6 +46,72 @@ use_format_targets()
 
 exports_files([
     "MODULE.bazel",
+    "MODULE.bazel.lock",
     "pyproject.toml",
     "known_good.json",
 ])
+
+sbom(
+    name = "sbom",
+    auto_cdxgen = False,
+    auto_crates_cache = True,
+    component_name = "score_reference_integration",
+    generation_context = "build",
+    module_lockfiles = [":MODULE.bazel.lock"],
+    output_formats = [
+        "spdx",
+    ],
+    targets = [
+        "//feature_integration_tests/test_scenarios/cpp:cpp_test_scenarios",
+        "//feature_integration_tests/test_scenarios/rust:rust_test_scenarios",
+        "//showcases/cli:cli",
+        "//showcases/orchestration_persistency:orch_per_example",
+        "@score_communication//score/mw/com/example/com-api-example:com-api-example",
+        "@score_kyron//examples:main_macro",
+        "@score_kyron//examples:safety_task",
+        "@score_kyron//examples:select",
+        "@score_logging//score/test/component/dlt_generator_app:dlt_generator",
+        "@score_logging//score/test/component/logging_app:logging_app",
+        "@score_time//examples/time/high_res_steady_time",
+        "@score_time//examples/time/steady_time",
+        "@score_time//examples/time/system_time",
+        "@score_time//examples/time/vehicle_time",
+    ],
+)
+
+# Product SBOM alias with an explicit lifecycle-oriented name.
+alias(
+    name = "product_sbom",
+    actual = ":sbom",
+    visibility = ["//visibility:public"],
+)
+
+# Qualification inventory for Python-based build and test tools. This is kept
+# separate from the product SBOM because build-time dependencies are not
+# product/runtime dependencies.
+sbom(
+    name = "build_tools_sbom",
+    testonly = True,
+    auto_cdxgen = False,
+    auto_crates_cache = False,
+    component_name = "score_reference_integration_build_tools",
+    # Pip repositories are represented authoritatively by python_lockfiles;
+    # exclude their generated Bazel aliases to avoid duplicate components.
+    exclude_patterns = ["rules_python++pip+"],
+    generation_context = "build",
+    java_files = ["@score_docs_as_code//src:plantuml.jar"],
+    output_formats = ["spdx"],
+    python_lockfiles = [
+        "//feature_integration_tests/test_cases:requirements.txt.lock",
+        "//scripts/tooling:requirements.txt",
+        "@score_docs_as_code//src:requirements_lock",
+    ],
+    targets = [
+        "//:docs_combo_experimental",
+        "//feature_integration_tests/test_scenarios/cpp:cpp_test_scenarios",
+        "//scripts/tooling:checkout_repos",
+        "//scripts/tooling:recategorize_guidelines",
+        "//scripts/tooling:tooling",
+        "@score_docs_as_code//src:plantuml",
+    ],
+)

MODULE.bazel

@@ -81,3 +81,27 @@ git_override(
     commit = "2792e2daee2cf524fdc7b1545fd3537791ebc36c",
     remote = "https://github.com/bmw-software-engineering/lobster.git",
 )
+
+bazel_dep(name = "score_sbom", version = "0.0.2")
+
+sbom_ext = use_extension("@score_sbom//:extensions.bzl", "sbom_metadata")
+sbom_ext.track_module(name = "score_sbom")
+sbom_ext.track_module(name = "score_baselibs")
+sbom_ext.track_module(name = "score_communication")
+sbom_ext.track_module(name = "score_persistency")
+sbom_ext.track_module(name = "score_orchestrator")
+sbom_ext.track_module(name = "score_kyron")
+sbom_ext.track_module(name = "score_lifecycle_health")
+sbom_ext.track_module(name = "score_logging")
+sbom_ext.track_module(name = "score_time")
+sbom_ext.track_module(name = "score_crates")
+sbom_ext.track_module(name = "score_itf")
+sbom_ext.track_module(name = "score_tooling")
+sbom_ext.track_module(name = "score_platform")
+sbom_ext.track_module(name = "score_bazel_platforms")
+sbom_ext.track_module(name = "score_test_scenarios")
+sbom_ext.track_module(name = "score_docs_as_code")
+sbom_ext.track_module(name = "score_process")
+sbom_ext.track_module(name = "trlc")
+sbom_ext.track_module(name = "lobster")
+use_repo(sbom_ext, "sbom_metadata")

README.md

@@ -65,6 +65,72 @@ Cross-compile all showcases and assemble the IFS image:
 bazel build --config=qnx-aarch64 //images/qnx_aarch64:image
 ```
 
+### Software Bill of Materials
+
+The root `//:sbom` target generates SPDX 2.3 and CycloneDX 1.6 documents for
+the integrated showcase and feature-test binaries. It consumes `sbom-tool`
+from the local git checkout at `../sbom-tool` in this workspace until the
+module is available in the Bazel registry.
+
+Install Node.js/npm and `@cyclonedx/cdxgen` before building the C++ dependency
+metadata, then run:
+
+```bash
+npm install -g @cyclonedx/cdxgen
+bazel build //:sbom
+```
+
+The generated documents are written below `bazel-bin/` as `sbom.spdx.json` and
+`sbom.cdx.json`. Rust crate metadata is collected automatically from the
+workspace lockfile and the configured `score_crates` module.
+
+### Selecting an SBOM mode
+
+Choose the mode based on what is being qualified:
+
+- **Product mode** is for the software delivered by the integration. It follows
+   the configured showcase and feature-test binaries and includes their runtime
+   dependencies. Use `//:product_sbom` (an alias of `//:sbom`) when you need both
+   SPDX and CycloneDX output for the product scope.
+- **Build-tool qualification mode** is for tools used to build, test, or
+   generate documentation. It is separate from the product scope because these
+   tools are not shipped as product runtime dependencies. Use
+   `//:build_tools_sbom` when collecting ISO 26262 qualification evidence for
+   the development toolchain.
+
+Build-tool mode includes the Python lockfiles used by the workspace tooling and
+docs-as-code, the Sphinx documentation toolchain, the PlantUML integration, and
+the PlantUML JAR itself with a SHA-256 checksum. It emits SPDX only and does
+not run cdxgen or the Rust crate cache collector.
+
+Build the selected mode as follows:
+
+```bash
+# Product/runtime dependencies
+bazel build //:product_sbom
+# Outputs: bazel-bin/product_sbom.spdx.json and bazel-bin/product_sbom.cdx.json
+
+# Build-tool qualification inventory (SPDX JSON)
+bazel build //:build_tools_sbom
+# Output: bazel-bin/build_tools_sbom.spdx.json
+```
+
+While testing the unpublished Python collector branch of `sbom-tool`, resolve
+it with the module override below. Apply the override to whichever mode you are
+building:
+
+```bash
+bazel build //:product_sbom \
+    --override_module=score_sbom=/workspaces/sbom-tool
+
+bazel build //:build_tools_sbom \
+   --override_module=score_sbom=/workspaces/sbom-tool
+```
+
+Once the collector branch is merged, replace this command-line override with
+the merged commit in the root `MODULE.bazel` git override.
+
+## Operating system integrations
 The built IFS image is written to:
 
 ```

feature_integration_tests/test_cases/BUILD

@@ -14,6 +14,8 @@ load("@pip_score_venv_test//:requirements.bzl", "all_requirements")
 load("@rules_python//python:pip.bzl", "compile_pip_requirements")
 load("@score_tooling//python_basics:defs.bzl", "score_py_pytest")
 
+exports_files(["requirements.txt.lock"])
+
 # In order to update the requirements, change the `requirements.txt` file and run:
 # `bazel run //feature_integration_tests/test_cases:requirements.update`.
 # This will update the `requirements.txt.lock` file.

scripts/tooling/BUILD

@@ -15,6 +15,8 @@ load("@rules_python//python:defs.bzl", "py_binary", "py_library")
 load("@rules_python//python:pip.bzl", "compile_pip_requirements")
 load("@score_tooling//python_basics:defs.bzl", "score_py_pytest")
 
+exports_files(["requirements.txt"])
+
 # In order to update the requirements, change the `requirements.in` file and run
 # `bazel run //scripts/tooling:requirements.update`
 # This will update the `requirements.txt` file